Backend API Development with ASP.NET Core

Day 1: REST API Design and Minimal APIs

Main Topics:

• REST principles and resource-oriented design

• ASP.NET Core minimal APIs vs. controller-based APIs

• Routing and HTTP verbs

• Request/response models (DTOs)

Detailed Subtopics:

• Designing consistent, predictable URL structures

• Choosing minimal APIs vs. controllers for a given project size

• Status codes and their correct usage

• Separating DTOs from domain/entity models

Hands-On Lab: Design and build a REST API for a task-management system with resource-oriented endpoints (GET/POST/PUT/DELETE for tasks), using minimal APIs.

Real-World Scenario: A frontend team is starting a new React application and needs a clean, predictable API contract to build against.

Learning Outcome: Participants can design and build a REST API following consistent, predictable resource-oriented conventions.

Day 2: Validation, Error Handling, and Data Access

Main Topics:

• Input validation strategies

• Consistent error responses with ProblemDetails

• Connecting the API to a database (Entity Framework Core)

• Pagination, filtering, and sorting

Detailed Subtopics:

• FluentValidation vs. data annotations for API input

• Returning structured, machine-readable error responses

• Implementing efficient paginated list endpoints

• Query parameter design for filtering and sorting

Hands-On Lab: Add validation and consistent ProblemDetails error responses to the Day 1 API, connect it to a real database with EF Core, and implement pagination and filtering on the list endpoint.

Real-World Scenario: The frontend team reports that error responses are inconsistent — some return plain text, some return HTML error pages — making error handling in the UI unreliable.

Learning Outcome: Participants can build an API with robust, consistent validation and error handling connected to a real data source.

Day 3: Authentication, Authorization, and Security

Main Topics:

• JWT-based authentication for APIs

• Role- and policy-based authorization

• API keys for machine-to-machine scenarios

• CORS configuration

Detailed Subtopics:

• Issuing and validating JWT tokens

• Securing endpoints with [Authorize] and custom policies

• Rate limiting to protect against abuse

• Configuring CORS correctly for a separate frontend origin

Hands-On Lab: Add JWT-based authentication to the API, restrict task-deletion to an Admin role, configure CORS for a separate frontend origin, and add basic rate limiting.

Real-World Scenario: The API currently has no authentication at all, and a security review requires it to be locked down before the frontend team can integrate against it in a shared environment.

Learning Outcome: Participants can secure an API appropriately for both user-facing and machine-to-machine consumption scenarios.

Day 4: Versioning, Documentation, and Production Readiness

Main Topics:

• API versioning strategies

• OpenAPI/Swagger documentation

• Health checks and monitoring endpoints

• Capstone: complete and document the API

Detailed Subtopics:

• URL, header, and query-string versioning approaches

• Generating accurate OpenAPI specs from code

• Exposing health check endpoints for monitoring

• Preparing an API for external/partner consumption

Hands-On Lab: Add versioning to the API to support a breaking change without disrupting existing consumers, generate complete OpenAPI documentation, and add a health check endpoint.

Real-World Scenario: A breaking change is needed to the task response format, but the mobile app team cannot update their client for another month and needs the old format to keep working.

Learning Outcome: Participants leave with a complete, secured, versioned, documented, production-ready REST API that other teams can integrate against confidently.